From: Bjorn Ruberg <bjorn@ruberg.no>
To: netfilter@lists.netfilter.org
Subject: Re: MAC Addresses in Logfile Entries
Date: 23 Apr 2003 07:19:53 +0200 [thread overview]
Message-ID: <1051075193.2441.13.camel@mikke> (raw)
In-Reply-To: <003401c3093d$ec896c30$0200a8c0@storm>
On Wed, 2003-04-23 at 04:13, Eric Poulin wrote:
> > Some of our log entries contain MAC addresses, like this:
> > Apr 20 10:15:35 foo kernel: IPT IN_FIREWALL: IN=eth1 OUT=
> > MAC=00:30:48:11:94:e5:00:d0:ba:45:ec:25:08:00 SRC=XXX.XX.XX.XX
> > DST=XXX.XX.XX.XX LEN=40 TOS=0x00 PREC=0x00 TTL=48 ID=0 DF PROTO=TCP
> > SPT=1572 DPT=1080 WINDOW=32430 RES=0x00 SYN URGP=0
> > While others don't:
> > Apr 14 07:55:35 foo kernel: IPT FORWARD: IN=eth0 OUT=eth1
> > SRC=XXX.XX.XX.XX DST=XXX.XX.XX.XX LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=225
> > DF PROTO=TCP SPT=1047 DPT=37 WINDOW=64512 RES=0x00 SYN URGP=0
> >
> > I see the "OUT" field in the latter contains "eth1" instead of a MAC
> > address.
> >
> > Can someone elaborate on the difference here? Thanks.
>
> I'm experiencing this bahavior for a while already, and from what I can see,
> I will only see the MAC address in the log ONLY if the packet was destinated
> for the local machine(Or was generated BY the machine), but I will never see
> MACs if the packet logged was for another machine than the firewall.
>
> If somebody can confirm...
Tim,
If you take a look at your own rules you will see that the rule with the
MAC address is one of your INPUT rules ("IPT IN_FIREWALL") while the
other one is a FORWARD rule ("IPT FORWARD").
Use that as a hint for further examination of your iptables rules and
the logs they produce.
Read the information on this web site as well:
http://logi.cc/linux/netfilter-log-format.php3
Bjorn
prev parent reply other threads:[~2003-04-23 5:19 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2003-04-23 1:07 MAC Addresses in Logfile Entries Tim Evans
2003-04-23 2:13 ` Eric Poulin
2003-04-23 5:19 ` Bjorn Ruberg [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1051075193.2441.13.camel@mikke \
--to=bjorn@ruberg.no \
--cc=netfilter@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.